Transport / 01
Small reply. Missing answer.
A truncated DNS response can fit comfortably inside a budget while omitting every answer record.
Reviewed October 15, 2026
The pair we captured
On October 15, 2026, we sent a query for valid.mldsa44.dnstest.dev A to 1.1.1.1 with DNSSEC requested and a 1232-byte EDNS setting. We saved the UDP reply, then made a separate TCP query. A third run with dig also reported an automatic TCP retry.
TC=1 · 0 answer records
TC=0 · 3 answer records
The 54 bytes consist of a 12-byte header, a 31-byte question and an 11-byte OPT record. The full message includes two A records and a 2,420-byte signature. These are captures from our test location, not a prediction of your connection. Use the sample commands and files to reproduce the comparison.
Three numbers that must not be conflated
- DNS message length
- Bytes in the DNS payload. The inspector counts these directly from wire input, or reads the reported value from dig.
- EDNS UDP size
- A sender-advertised capacity. A response’s OPT field does not reconstruct every setting used by the original requestor.
- Path MTU
- The smallest link MTU along a route. DNS payload bytes alone cannot measure it; IP and UDP headers also occupy space.
1232, 1400 or 4096?
1232 is the value in this experiment. RFC 9715, an Informational RFC, recommends a maximum DNS/UDP payload of 1400 in its guidance and permits smaller limits, with network constraints also considered. The inspector lets you compare values; it does not recommend changing your resolver to whichever number makes the bar fit.
The full captured message exceeds 1232 by 1331 bytes and 1400 by 1163 bytes. A 4096-byte budget accommodates the message numerically. That does not demonstrate that such a UDP datagram would traverse your actual route without fragmentation or loss.
What to test after a timeout
- Save the exact query and resolver address. Check whether the response is truncated, missing, or an explicit error.
- Run a separate TCP query from the same network. Keep the successful output or error; do not infer TCP success from TC alone.
- Compare firewall and resolver transport behavior using your own operational controls.
- Repeat the application’s real workflow. A DNS experiment alone does not establish web or email availability.
RFC 7766 covers DNS over TCP. WireBudget has no live port test, packet capture or automatic network repair.